Any set of flags on a princ to allow an AS but no TGS request?

[Chris Hecker]

I'd like to make a princ that can be used to test whether the kdc is
working for login, but I don't want this princ to be able to get tickets
to any services (except the initial TGT).  I can turn off u2u with dup
skey, and I tried setting the -maxlife to 0 but that defaulted to 24
hours, and even setting -maxlife "1 second" still lets kvno get tickets
for a while (I assume for the clock skew window, though the tickets have
a start time after their expires time, so maybe they're not usable, I
haven't tried using them).  Am I missing something obvious?

Chris